chore(deps): consolidate open version bumps

.github/actions/supply-chain-attest/action.yaml

@@ -100,7 +100,7 @@ runs:
 
     - name: Attest SBOM
       if: inputs.scan-mode == 'sbom'
-      uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4
+      uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4
       with:
         subject-name: ${{ inputs.image-name }}
         subject-digest: ${{ inputs.image-digest }}

.github/workflows/ci.yaml

@@ -212,7 +212,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         id: setup-go
         with:
           go-version-file: go.work
@@ -243,7 +243,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         id: setup-go
         with:
           go-version-file: go.work
@@ -374,7 +374,7 @@ jobs:
         target: [common, keystone, c5c3, horizon, glance]
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: go.work
       - name: Run unit tests
@@ -411,7 +411,7 @@ jobs:
         target: [common, keystone, c5c3, horizon, glance]
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: go.work
       # Derive the envtest k8s version from the Makefile (single source of truth).
@@ -453,7 +453,7 @@ jobs:
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: go.work
       - name: Run race-detected tests
@@ -472,7 +472,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: go.work
       - name: Install govulncheck
@@ -489,7 +489,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         id: setup-go
         with:
           go-version-file: go.work
@@ -592,7 +592,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: go.work
       - name: Create kind cluster
@@ -890,7 +890,7 @@ jobs:
       matrix: ${{ fromJson(needs.changes.outputs.e2e-operators) }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: go.work
       - name: Create kind cluster
@@ -1762,7 +1762,7 @@ jobs:
       matrix: ${{ fromJson(needs.changes.outputs.tempest-releases) }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: go.work
       - name: Create kind cluster

deploy/kind/base/flux-web.yaml

@@ -46,7 +46,7 @@
 #
 # Version pin: `spec.inputs[0].version` is a SemVer range locked to the
 # minor track of `FLUX_OPERATOR_VERSION` in hack/deploy-infra.sh (today
-# v0.54.1 → 0.54.x). Bump both together when upgrading the operator.
+# v0.55.0 → 0.55.x). Bump both together when upgrading the operator.
 #
 ---
 apiVersion: fluxcd.controlplane.io/v1
@@ -63,7 +63,7 @@ spec:
   # This keeps the kind-only addon self-contained — no extra
   # ResourceSetInputProvider CR to maintain.
   inputs:
-    - version: "0.54.x"
+    - version: "0.55.x"
   resources:
     - apiVersion: source.toolkit.fluxcd.io/v1
       kind: OCIRepository

docs/reference/infrastructure/e2e-deployment.md

@@ -337,9 +337,9 @@ the new release artifacts, compute `sha256sum`, and replace the values in the sc
 | Tool | Version | SHA256 Pinning |
 | --- | --- | --- |
 | chainsaw | v0.2.15 | upstream (fetched) |
-| flux | 2.8.8 | pinned |
+| flux | 2.9.2 | pinned |
 | kind | v0.32.0 | pinned |
-| kubectl | v1.36.1 | pinned |
+| kubectl | v1.36.2 | pinned |
 
 ## Quick Start
 

hack/deploy-infra.sh

@@ -255,7 +255,7 @@ GATEWAY_API_CRDS_URL="${GATEWAY_API_CRDS_URL:-https://github.com/kubernetes-sigs
 # flux-operator release applied in Step 2 before the FluxInstance CR is created
 # Kept as a script-local constant so Renovate can bump it
 # via renovate.json custom managers.
-FLUX_OPERATOR_VERSION="v0.54.1"
+FLUX_OPERATOR_VERSION="v0.55.0"
 
 # OpenBao init parameters (match deploy/openbao/bootstrap/init-unseal.sh)
 KEY_SHARES=5

hack/install-test-deps.sh

@@ -17,9 +17,9 @@ INSTALL_DIR="${INSTALL_DIR:-${HOME}/.local/bin}"
 # Pinned versions
 # ---------------------------------------------------------------------------
 CHAINSAW_VERSION="v0.2.15"
-FLUX_VERSION="2.8.8"
+FLUX_VERSION="2.9.2"
 KIND_VERSION="v0.32.0"
-KUBECTL_VERSION="v1.36.1"
+KUBECTL_VERSION="v1.36.2"
 
 # ---------------------------------------------------------------------------
 # Pinned SHA256 hashes.
@@ -35,13 +35,13 @@ KUBECTL_VERSION="v1.36.1"
 # Use plain variables instead of associative arrays for bash 3.2 (macOS) compatibility.
 # These are referenced via indirect expansion (e.g. ${!_flux_var}).
 # shellcheck disable=SC2034
-FLUX_SHA256_linux_amd64="3791d8fbb73b967ada021186f7b46686a2b180ce206d3c279c3f2ad183877a7f"
+FLUX_SHA256_linux_amd64="4092b367fd060097976fb7261601f79420ecf7266328417dfd8dfee27de0e6a3"
 # shellcheck disable=SC2034
-FLUX_SHA256_linux_arm64="738604ab040055ace69777988a24def98ada1aff14ae4726e733089dc8cc5e12"
+FLUX_SHA256_linux_arm64="665bfe5aeb843faf907e7f77250c31840499ff2dc65a64c2479409e3728748d1"
 # shellcheck disable=SC2034
-FLUX_SHA256_darwin_amd64="dcff834cd7b78acd22efd182b8a3bc08193cb00e734d62969070c2d888b1ded7"
+FLUX_SHA256_darwin_amd64="e4583db32e4f4f4ec195084f0381c704e5104a55a7ec4c1a444396137ecdb161"
 # shellcheck disable=SC2034
-FLUX_SHA256_darwin_arm64="f54bb4d83cfc9563fd3213381d50fe1102215ef904ecf9c38afa183b02c74eb7"
+FLUX_SHA256_darwin_arm64="1dd6791738b1c250748c24c24b48e92908881596f999ad8bf10f84763d66fdb3"
 
 # shellcheck disable=SC2034
 KIND_SHA256_linux_amd64="50030de23cf40a18505f20426f6a8506bedf13c6e509244bd1fa9463721b0f54"
@@ -53,13 +53,13 @@ KIND_SHA256_darwin_amd64="295ac6d0d634c9819c9907df45e3017d1f13166bd13c3404c45e79
 KIND_SHA256_darwin_arm64="dca67911095a110c2b5c36e26df6cac860c602033e456c0db47be498cdef1ebb"
 
 # shellcheck disable=SC2034
-KUBECTL_SHA256_linux_amd64="629d3f410e09bf49b64ae7079f7f0bda1191efed311f7d37fdbab0ad5b0ec2b7"
+KUBECTL_SHA256_linux_amd64="1e9045ec32bea85da43de85f0065358529ea7c7a152eca78154fba5b58c27d82"
 # shellcheck disable=SC2034
-KUBECTL_SHA256_linux_arm64="59f7ee8e477fae658447607dc3c8790ac17a1b016c01c622c12070e969e2d4e7"
+KUBECTL_SHA256_linux_arm64="c957eb8c4bea27a3bb35b269edd9082e27f027f7b76b20b5bf4afebc726c6d3e"
 # shellcheck disable=SC2034
-KUBECTL_SHA256_darwin_amd64="b4973e90ebb00537d735b63d6f8293c1959156e6ff435f6a43c08aeaa1a2e7d7"
+KUBECTL_SHA256_darwin_amd64="ce6c5e55cd17559e87e4fb5e73ebbbc2511bcf2b695d7a40c1b1461a9817d4b3"
 # shellcheck disable=SC2034
-KUBECTL_SHA256_darwin_arm64="9092778abaef3079449da4cd70ded0e4be112480c93efcdeace3155968d1d133"
+KUBECTL_SHA256_darwin_arm64="4408c85c83fd3a31adaa555bdf3c7a6c81f74b19449a9060ba31ab91926f023d"
 
 # ---------------------------------------------------------------------------
 # log — Print a timestamped log message (ISO 8601 UTC).

internal/common/go.mod

@@ -18,7 +18,7 @@ require (
 	k8s.io/client-go v0.36.2
 	k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3
 	sigs.k8s.io/controller-runtime v0.24.1
-	sigs.k8s.io/gateway-api v1.5.1
+	sigs.k8s.io/gateway-api v1.6.1
 	sigs.k8s.io/yaml v1.6.0
 )
 
@@ -30,31 +30,31 @@ require (
 	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
 	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.1 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/zapr v1.3.0 // indirect
-	github.com/go-openapi/jsonpointer v0.22.5 // indirect
+	github.com/go-openapi/jsonpointer v0.23.1 // indirect
 	github.com/go-openapi/jsonreference v0.21.5 // indirect
-	github.com/go-openapi/swag v0.25.5 // indirect
-	github.com/go-openapi/swag/cmdutils v0.25.5 // indirect
-	github.com/go-openapi/swag/conv v0.25.5 // indirect
-	github.com/go-openapi/swag/fileutils v0.25.5 // indirect
-	github.com/go-openapi/swag/jsonname v0.25.5 // indirect
-	github.com/go-openapi/swag/jsonutils v0.25.5 // indirect
-	github.com/go-openapi/swag/loading v0.25.5 // indirect
-	github.com/go-openapi/swag/mangling v0.25.5 // indirect
-	github.com/go-openapi/swag/netutils v0.25.5 // indirect
-	github.com/go-openapi/swag/stringutils v0.25.5 // indirect
-	github.com/go-openapi/swag/typeutils v0.25.5 // indirect
-	github.com/go-openapi/swag/yamlutils v0.25.5 // indirect
+	github.com/go-openapi/swag v0.26.0 // indirect
+	github.com/go-openapi/swag/cmdutils v0.26.0 // indirect
+	github.com/go-openapi/swag/conv v0.26.0 // indirect
+	github.com/go-openapi/swag/fileutils v0.26.0 // indirect
+	github.com/go-openapi/swag/jsonname v0.26.0 // indirect
+	github.com/go-openapi/swag/jsonutils v0.26.0 // indirect
+	github.com/go-openapi/swag/loading v0.26.0 // indirect
+	github.com/go-openapi/swag/mangling v0.26.0 // indirect
+	github.com/go-openapi/swag/netutils v0.26.0 // indirect
+	github.com/go-openapi/swag/stringutils v0.26.0 // indirect
+	github.com/go-openapi/swag/typeutils v0.26.0 // indirect
+	github.com/go-openapi/swag/yamlutils v0.26.0 // indirect
 	github.com/google/gnostic-models v0.7.1 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/onsi/ginkgo/v2 v2.29.0 // indirect
+	github.com/onsi/ginkgo/v2 v2.32.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/prometheus/common v0.67.5 // indirect
@@ -76,7 +76,7 @@ require (
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	k8s.io/klog/v2 v2.140.0 // indirect
-	k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a // indirect
+	k8s.io/kube-openapi v0.0.0-20260501160325-927ab1f70cd6 // indirect
 	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
 	sigs.k8s.io/structured-merge-diff/v6 v6.4.0 // indirect